MALICIOUS — 1175835.pdf

MALICIOUS — 1175835.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100). 5 of 50 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 53197de53c0482bc4cdc9e13da21babce3497a372b011a2afc6d11af35fa931e
SHA-1: 4b309696de675eab9347e33e28d93f9956390f5f
MD5: 65a93a31a034965761bfb3ef0ff2645a
ssdeep: 1536:X3W32H/8DewEl+urjxM1fLem7JDRBPddE7+b+RCpoG2N6eWsz0s2k3:HWGH/qBuPxMJeMPHau+8pD2N6+z5t
TLSH: T1FC37E1F3A15BDC4C7FC64F93A9A6626D745DE20422734A9841C8FB2CC4BC6BD2E60911
Submitted as: 1175835.pdf
File type: pdf · Size: 74640 bytes
Verdict: malicious (100/100)

Detections (5 of 50 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!65A93A31A034
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Lazarus): root_.cache_dconf_user - dynamic signal, weight 0.80, confidence 0.90
Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged PDF/Phish-FAB!65A93A31A034 (rule PDF/Phish-FAB!65A93A31A034) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Hoax.PDF.Phish.gen (rule HEUR:Hoax.PDF.Phish.gen) - engine signal, weight 0.55, confidence 0.85
Contacted 30 external host(s) at runtime (7 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: http://letxxnx.org/series_and_parallel_circuits_workshegqq2p.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://gettraff.ru/wb?keyword=jungle%20adventure%20man, https://cdn.sqhk.co/japexexuko/5iaRU7r/domuwuwevapub.pdf, https://cdn-cms.f-static.net/uploads/4464996/normal_5fd83e3100790.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (16 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9685 behavior events · 1 ATT&CK techniques · 4 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/2cbcf400-ac8d-4d86-9d69-c7f0dff56d2e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/2cbcf400-ac8d-4d86-9d69-c7f0dff56d2e?P1=1787094279&P2=404&P3=2&P4=nDjqvLrS9kLz3oLxDbu06J998CgH3yTG4DprPWiY%2b77ImEBPSNBfXLtBHgKWiqJxyYAyEiv4fKx413S%2bzfnRzg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/58b2a9b1-8570-476c-a7c2-f7ab0a20fbf9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/58b2a9b1-8570-476c-a7c2-f7ab0a20fbf9?P1=1787094304&P2=404&P3=2&P4=YKkGVPI02BlNCD67Ea3pU6LtCTbDTs6GqsawaYYLNLADmORq8%2bFpBxHR24WtHeamlOY7M4NVcaEr%2bB7ouXnK%2bw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
23.40.52.209
23.11.37.157
40.126.14.161

Dropped files

/opt/CAPEv2/storage/analyses/30787/files/7b98e51ec32383967278652b3721e3e8d6bb01b6a2a4dfdb4858ec063fb472a2 - 7b98e51ec32383967278652b3721e3e8d6bb01b6a2a4dfdb4858ec063fb472a2
/opt/CAPEv2/storage/analyses/30787/files/d010e3600f3a57bddd2414cb4765cc34bededc83f832c75fce591afac7d63551 - d010e3600f3a57bddd2414cb4765cc34bededc83f832c75fce591afac7d63551
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
tmp_tmp.4EMNElWCMQ - 69a443b32d7d48c61b0ad7cfbd93d935f15a9a82b38b18c6d8c0c54079f8907e

Embedded URLs

https://gettraff.ru/wb?keyword=jungle%20adventure%20man
https://cdn.sqhk.co/japexexuko/5iaRU7r/domuwuwevapub.pdf
https://cdn-cms.f-static.net/uploads/4464996/normal_5fd83e3100790.pdf
http://fobukisa.rf.gd/galway_girl_bagpipe_sheet_music.pdf
http://artistichomesolutions.com/vunurokumijeririfonakinuri6ptg.pdf
http://vzruvayarttraff.xyz/922622539863tfj3.pdf
https://cdn-cms.f-static.net/uploads/4481847/normal_5fe9f35e89c57.pdf
https://cdn.sqhk.co/sovokeduseb/6CvLhgC/71423280521.pdf
http://kudogal.rf.gd/danganronpa_v3_character_gift_guide.pdf
http://letxxnx.org/series_and_parallel_circuits_workshegqq2p.pdf
https://cdn.sqhk.co/lilomovetum/dEBhahd/smithsonian_channel_new_shows.pdf
https://static.s123-cdn-static.com/uploads/4416331/normal_5fca461aa8df8.pdf
http://nolonogatifotop.epizy.com/79504871391.pdf
http://consumer-data-protection-bureau.com/70594736414k6bh8.pdf
http://figebofisekozoj.22web.org/85120705660.pdf
https://cdn.sqhk.co/romilononove/2gdIQgi/wikanojezuxovujodude.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

gettraff.ru
cdn.sqhk.co
cdn-cms.f-static.net
artistichomesolutions.com
vzruvayarttraff.xyz
letxxnx.org
static.s123-cdn-static.com
nolonogatifotop.epizy.com
consumer-data-protection-bureau.com
figebofisekozoj.22web.org
www.w3.org
purl.org
ns.adobe.com
fobukisa.rf.gd
kudogal.rf.gd

Embedded IP addresses

52.123.252.220
52.110.12.16
20.247.184.197
20.42.179.204
4.230.171.124
72.153.5.138
203.26.79.13
74.179.77.164
51.132.193.104
135.232.92.137
52.123.252.215
52.123.128.14
74.178.76.44
172.178.240.163
74.178.240.61
172.170.180.133
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report